4 ms·

This is possible on code128 barcode. This kind of barcode accepts not only numbers but also chars. Usually consumers deal with EAN13 barcode on the supermarket,

This is possible on code128 barcode. This kind of barcode accepts not only numbers but also chars. Usually consumers deal with EAN13 barcode on the supermarket, they only accept numbers and this attack is impossible.

crisp 11y ago
This was something I wasn't sure of. How do you know this for a fact?
- chiph 11y ago
  Because the "A" variant of Code128 allows you to have control characters in there. Many barcode readers act like keyboards to the computer - so the clerk/user positions their cursor to the item number field, waves the item in front of the scanner, and the scanner hardware inserts what it read into the field. Fast, reliable, and easy. But if the barcode contains control characters, it acts like a keyboard macro and will send them to the application. So if I embed a Ctrl-S in my hostile barcode, I can tell the software to save the record with data I supplied.
  - crisp 11y ago
    I actually wanted to know how marvel_boy knows that consumers usually deal with EAN13 barcode instead of code128. As he or she states, EAN13 barcodes would make this kind of attack impossible so I wanted to know if this is a real everyday problem concerning most of the stores or only a minority of them.
    - chiph 11y ago
      Look at the products you buy at the store (supermarket, Walmart, Target, etc) - the barcode is almost always EAN (now IAN)¹ There are exceptions for smaller items like packs of gum, which use UPC-E² encoding (if the manufacturer portion ends in zeros). Hundreds of thousands of products being purchased by billions of people mean they're the dominant barcode system. So far as attacks via UPC/EAN/IAN, they're not really possible as it only encodes digits, and only 13 of them. ¹ https://en.wikipedia.org/wiki/International_Article_Number_(EAN) https://en.wikipedia.org/wiki/International_Article_Number_(... ² http://www.barcodeisland.com/upce.phtml http://www.barcodeisland.com/upce.phtml
kazkur 11y ago
Most barcode scanners are programmed by scanning special barcodes provided by the manufacturer. You can enable/disable any barcode standard. Then you can use the barcode scanner as a slow keyboard.
j-b 11y ago
I've written barcode processing software specifically for the retail market. There is a wide array of barcodes that will be used in the retail grocery store. UPC-E, EAN-8, UPC-A, EAN-13, EAN-14, GS1, GTIN, CODE128, and PDF417 (for drivers license scanning or smart phone apps, e.g. Starbucks app barcodes).

crisp 11y ago

This was something I wasn't sure of. How do you know this for a fact?

chiph 11y ago
Because the "A" variant of Code128 allows you to have control characters in there. Many barcode readers act like keyboards to the computer - so the clerk/user positions their cursor to the item number field, waves the item in front of the scanner, and the scanner hardware inserts what it read into the field. Fast, reliable, and easy. But if the barcode contains control characters, it acts like a keyboard macro and will send them to the application. So if I embed a Ctrl-S in my hostile barcode, I can tell the software to save the record with data I supplied.
- crisp 11y ago
  I actually wanted to know how marvel_boy knows that consumers usually deal with EAN13 barcode instead of code128. As he or she states, EAN13 barcodes would make this kind of attack impossible so I wanted to know if this is a real everyday problem concerning most of the stores or only a minority of them.
  - chiph 11y ago
    Look at the products you buy at the store (supermarket, Walmart, Target, etc) - the barcode is almost always EAN (now IAN)¹ There are exceptions for smaller items like packs of gum, which use UPC-E² encoding (if the manufacturer portion ends in zeros). Hundreds of thousands of products being purchased by billions of people mean they're the dominant barcode system. So far as attacks via UPC/EAN/IAN, they're not really possible as it only encodes digits, and only 13 of them. ¹ https://en.wikipedia.org/wiki/International_Article_Number_(EAN) https://en.wikipedia.org/wiki/International_Article_Number_(... ² http://www.barcodeisland.com/upce.phtml http://www.barcodeisland.com/upce.phtml

kazkur 11y ago

Most barcode scanners are programmed by scanning special barcodes provided by the manufacturer. You can enable/disable any barcode standard. Then you can use the barcode scanner as a slow keyboard.

j-b 11y ago

I've written barcode processing software specifically for the retail market. There is a wide array of barcodes that will be used in the retail grocery store. UPC-E, EAN-8, UPC-A, EAN-13, EAN-14, GS1, GTIN, CODE128, and PDF417 (for drivers license scanning or smart phone apps, e.g. Starbucks app barcodes).